White screen

shawn77 said:
Hi Vistaking

Let me explain to you regarding ransomwares.Ransomware hooks entries in multiple locations.Winlogon and Run keys.Fixing both the keys using recovery console method will fail and user will just have a white screen because the ransomware is active.

If the user can't get into save mode the programs you're mentioning is useless .
Click to expand...

Wrong.How did user try the system restore or access MSCONFIG in his previous steps?

Safemode with command prompt gives us a command window.Flash drive can be accessed and any security tools can be used to scan our system without launching the explorer window.

Safemode with command prompt or FRST are best way to fix it.Launching registry in recovery console is time consuming.
Click to expand...

Shawn you don't have to explain anything for me. Trust me I know what I am doing. I am not going to argue with you. The reason why she or he isn't allowed to get on to explorer.exe is cause the virus is starting it from when the PC starts up. IF you go to the registry and change the shell from what is on there to explorer.exe he or she will be able to get into safe mode and safe mode with networking. You have a matter of seconds until the virus loads up.

For a user to get to his flash drive he or she would have to know the drive letter of his flash drive.

That is why when I had the user do bcdedit | find "osdevice" it pointed to D .
 

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
For a user to get to his flash drive he or she would have to know the drive letter of his flash drive.
Click to expand...

User is able to boot into safemode w/command prompt.From command prompt,type notepad and hit the Enter key.

Press File>>Open and you can see flash drive letter.Simple right?
 

My Computer

OS
32 bit
You could do that or you could use DISKPART . Then type list volume
 

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
Instead of squabbling over who's solution is the best, why not try to work together to solve the OP's problem? Just sayin' . . .
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Sony Vaio VPCEB47GM Laptop
OS
Win 7 Pro 64-bit
CPU
Intel i5 2.4 Ghz
Memory
8GB DDR3
Graphics Card(s)
Intel HD 3000
Sound Card
IDT High Definition
Monitor(s) Displays
15.6 WGXA Anti-Glare LED
Screen Resolution
1280x800
Hard Drives
640Gb 7200rpm
Antivirus
MSE
Browser
Opera (primary) with IE9 backup
Mars. That is what is why I said I don't want to argue. Main focus is to get the user working again.
 

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
Helping PattieO is the priority!!

However, PattieO has not been here for more than 20 hours, and by now, is probably totally confused.
There is no need for this, even this old dog got confused.

PattieO can boot to Safe Mode with Networking, as seen on Post #22. HitmanPro was suggested, and already run, but, apparently, it did not finish the job.

Boot up the system from USB a flash drive loaded with HitmanPro.KickStart, and bypass the ransomware!

KickStart recognizes files and Registry keys belonging to this ransomware.
There is no need to do this manually.

When finished with KickStart, RogueKiller can be used to remove any remnants, resolve DNS issues, etc.

>>Got instructions ready to roll if PattieO wishes to go this route.<<

Emsisoft can also be used, but, IMO HitmanPro.KickStart is "the kicker".
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Cottonball ,

That is what I was trying to do . Is help the user NOT to argue about things .
 

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
...help the user NOT to argue about things
Click to expand...

I really think that is what we have meant to do, VistaKing.

Just sort of took on an occassional bump on the road...

Let's just hope PattieO has not written us off as a good source of help...
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Lets get :focus: and help the user out . That is why we are here
 

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
She may have left the building with all this squabble ... :shock:

My "input" was to flush the DNS cache and restore MS's Hosts file, so she could possibly get back online in safe mode with networking.
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Bruce ... somewhere in his 40's
OS
Windows 7 Ultimate 32bit SP1
CPU
Intel(R) Core(TM)2 Quad CPU @ 2.40GHz, 2400 MHz
Motherboard
INTEL/D975XBX2
Memory
4 GB
Graphics Card(s)
ATI Radeon HD 2600 Pro
Monitor(s) Displays
Samsung SyncMaster 914v
Screen Resolution
1280 x 1024
Hard Drives
2/500GB each ... ST3500630AS ATA Device.
One is not connected
PSU
Rocketfish 700 W
Case
G.Skill Gigabyte Chassis
Keyboard
Standard PS/2 Keyboard
Mouse
Microsoft PS/2 Mouse
Internet Speed
DSL
Antivirus
Avira Internet Security
Browser
IE 11
Other Info
ATI HDMI Audio
Jacee,

...could possibly get back online in safe mode with networking.
Click to expand...

Looks as if SM w/Networking was used in Post #22.

So, the Advanced Boot Options menu did come up, and could be used.

When your post came up, thought you were trying to get some of the possible garbage out of the way.

Either way...:D...whatever works.
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
PattieO …

   Note
Backup your flash drive cause it will be wiped doing the steps below


Create a HitmanPro Kickstart USB flash drive, on a “clean” (non-infected) computer, download HitmanPro from the below link.


Download

( you should already have that )

Insert your USB flash drive into your computer (clean non infected) and launch the HitmanPro program .

Inside the program, click on the flying kick icon . Once you see your flash drive icon inside the program click on it and click on the Install Kickstart button ( this will wipe the flash drive ) click Yes to continue .

Once you're done remove the flash drive using the Safely Remove Hardware inside the systray next to the time on the right hand side . (Icon is a USB cord with a green circle with a white checkmark) .

Plug the USB drive to the infected computer and restart the PC . While the PC is starting up press F12 and choose USB device

Scan the computer with HITMAN and delete anything it finds and remove the USB drive and restart the PC .
 
Last edited:

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
Hmmmm....

The Download above is for HitmanPro_x64.exe

Don't see where the User has mentioned whether the system is 32-bit or 64-bit, though...

If PattieO does not come back, for whoever uses this info in the future, might be best to Edit and add the 32-bit .exe






 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Hi Cottonball

That is the one she said she downloaded it.

She downloaded the FRST64 version so I presume she has x64 bit OS

Here
 

My Computer

Computer Manufacturer/Model Number
Custom Built
OS
Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
CPU
Intel Core i7 CPU 950 @ 3.07GHz
Motherboard
ASUS P6T DELUXE V2
Memory
OCZ 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1600 OCZ3X1600R2
Graphics Card(s)
ATI Radeon HD 5700 Series
Sound Card
OnBoard
Hard Drives
WD6400AACS-00M3B0 (640GB SATA )
PSU
CORSAIR 850w
Case
NZXT LEXA
Cooling
Intel Stock Heatsink Fan
Keyboard
Microsoft Wireless Laser Keyboard 7000
Mouse
Microsoft Wireless Laser Mouse 7000
My bad!!!! :confused:
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Disregard, wrong topic.
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
You must log in or register to reply here.
Back
Top